Allow strict mode compilation when action SHA resolution fails#15096
Merged
Allow strict mode compilation when action SHA resolution fails#15096
Conversation
…resolution failures Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Update strict mode to warn without failing on action pin resolution
Allow strict mode compilation when action SHA resolution fails
Feb 12, 2026
Contributor
🔍 PR Triage ResultsCategory: bug | Risk: medium | Priority: 43/100 Scores Breakdown
📋 Recommended Action: deferExplanation: This WIP PR addresses action pin resolution failures in strict mode by converting errors to warnings. The approach is sensible but needs completion and CI validation before review. Next Steps:
Triaged by PR Triage Agent on 2026-02-12
|
github-actions
bot
added
pr-action:defer
pr-priority:medium
pr-risk:medium
pr-type:bug
labels
pelikhan
approved these changes
Feb 12, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adjusts workflow compilation behavior so that failures to resolve/pin GitHub Actions SHAs no longer block compilation in strict mode, reflecting that pin resolution can legitimately fail (rate limits, network, private repos).
Changes:
- Update
GetActionPinWithDatato emit warnings and return an empty pin instead of erroring when no pin can be resolved (including strict mode). - Update strict-mode logging tests to assert warning behavior rather than expecting an error.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pkg/workflow/action_pins.go | Removes strict-mode fatal error on unresolved pins; emits warnings and continues compilation. |
| pkg/workflow/action_pins_logging_test.go | Updates strict-mode test to validate warnings/no-error behavior. |
Comments suppressed due to low confidence (2)
pkg/workflow/action_pins.go:163
- GetActionPinWithData dereferences
data(e.g.,data.StrictMode,data.ActionResolver,data.ActionPinWarnings) without a nil check. Since the function accepts*WorkflowData, a nil caller would panic. Add an early guard (e.g., treat nil as default non-strict/no-resolver) or change the contract to explicitly reject nil with a returned error.
func GetActionPinWithData(actionRepo, version string, data *WorkflowData) (string, error) {
actionPinsLog.Printf("Resolving action pin: repo=%s, version=%s, strict_mode=%t", actionRepo, version, data.StrictMode)
pkg/workflow/action_pins_logging_test.go:192
- In the
expectSuccessbranch, the test assertsresult != ""but does not assert that no warning was emitted. Add an assertion thatstderrOutputdoes not contain a warning marker/message (e.g., "Unable to pin action" or "⚠") to ensure successful strict-mode resolution stays quiet.
if tt.expectSuccess {
// Should not emit warning and return non-empty result
if err != nil {
t.Errorf("Unexpected error: %v", err)
}
if result == "" {
t.Errorf("Expected non-empty result")
}
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // so we now emit a warning and continue compilation in both modes | ||
|
|
||
| // In non-strict mode, emit warning and return empty string (unless it's already a SHA) | ||
| // In both strict and non-strict mode, emit warning and return empty string (unless it's already a SHA) |
There was a problem hiding this comment.
Grammar: "In both strict and non-strict mode" should be "In both strict and non-strict modes".
Suggested change
| // In both strict and non-strict mode, emit warning and return empty string (unless it's already a SHA) | |
| // In both strict and non-strict modes, emit warning and return empty string (unless it's already a SHA) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Strict mode was blocking compilation when unable to resolve action SHAs. This is overly restrictive - resolution can fail due to rate limits, network issues, or private repositories.
Changes
pkg/workflow/action_pins.go: Removed strict mode error path for unresolved action pins. Now emits warning and continues compilation in both modes.pkg/workflow/action_pins_logging_test.go: Updated test expectations from error to warning.Behavior
Before:
After:
Strict mode now treats action pin resolution failures as non-fatal, allowing workflows to compile and run with best-effort SHA pinning.
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.